From: Michael S. Tsirkin Commit bed8bdfd ("IB: kmemdup() cleanup") introduced one bad conversion to kmemdup() in mthca_alloc_fmr(), where the structure allocated and the structure copied are not the same size. Revert this back to the original kmalloc()/memcpy() code. Reported-by: Dotan Barak . Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier Signed-off-by: Andrew Morton --- drivers/infiniband/hw/mthca/mthca_provider.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff -puN drivers/infiniband/hw/mthca/mthca_provider.c~ib-mthca-fix-fmr-breakage-caused-by-kmemdup-conversion drivers/infiniband/hw/mthca/mthca_provider.c --- a/drivers/infiniband/hw/mthca/mthca_provider.c~ib-mthca-fix-fmr-breakage-caused-by-kmemdup-conversion +++ a/drivers/infiniband/hw/mthca/mthca_provider.c @@ -1100,10 +1100,11 @@ static struct ib_fmr *mthca_alloc_fmr(st struct mthca_fmr *fmr; int err; - fmr = kmemdup(fmr_attr, sizeof *fmr, GFP_KERNEL); + fmr = kmalloc(sizeof *fmr, GFP_KERNEL); if (!fmr) return ERR_PTR(-ENOMEM); + memcpy(&fmr->attr, fmr_attr, sizeof *fmr_attr); err = mthca_fmr_alloc(to_mdev(pd->device), to_mpd(pd)->pd_num, convert_access(mr_access_flags), fmr); _